Back

@dangoodin @GossiTheDog The threat actor doesn't need to be unauthorized, they could be merely unwitting - eg. a VDI user. It's not clear here (nor technically required) that a VM escape from a guest OS require root level privileges in the guest OS; it merely requires the right sequence of events and code paths to be possible to influence and escape into the outer process context the VM virtual CPUs run in.